Senior Elastic Stack Data Ingestion Architect

Amentum company; Colorado Springs (CO); On-site; USD 140,000 - 160,000; Full time

Benefits offered by this job

Health, dental, and vision insurance

Paid time off and holidays

401(k) retirement benefits matching

Educational reimbursement

Parental leave

Employee stock purchase plan

Disability and life insurance

Pet insurance

Job summary

Amentum seeks a Senior Elastic Stack Data Integration Engineer to design, build, and maintain high-fidelity data ingestion pipelines for Elastic SIEM. You will architect Logstash pipelines ingesting logs from diverse sources, implement parsing, ECS alignment, and enrichment, and ensure reliable delivery to Elasticsearch in secure environments.

This position is based at Schriever Space Force Base, CO or Redstone Arsenal, AL, with up to 10% travel.

Qualifications

• 4+ years of general (full-time) work experience; may be reduced with advanced education
• 3+ years of directly related experience in log ingestion, data engineering, or SIEM pipeline development
• 2+ years of leadership experience in a management role
• Strong background in Elastic Stack components (Elasticsearch, Kibana, Beats, Elastic Agent)
• Experience with data ingestion, processing, and enrichment techniques
• Hands-on experience ingesting, processing, and normalizing diverse log types (Windows events, syslog, firewall logs, cloud telemetry)
• Proficiency with Linux administration, system-level debugging, and CLI operations
• DoD 8570.01-M IAT Level II certification with CE (CCNA-Security, CySA+, GICSP, GSEC, Security+ CE, CND, SSCP)
• DoW Secret Security Clearance (active) and ability to obtain DoW Top Secret clearance

Responsibilities

• Architect, build, and maintain Logstash pipelines to ingest and transform logs from diverse systems.
• Implement parsing, GROK patterns, JSON transformations, and ECS mapping.
• Optimize pipeline performance, resiliency, and scalability with HA and tuning.
• Ensure ingested data aligns to ECS or internal schema requirements.
• Implement data enrichment workflows (GeoIP, threat intel, metadata injection).
• Validate data completeness, integrity, and fidelity across ingestion flows.
• Maintain and optimize Logstash clusters, including version management and high availability.
• Manage integrations with Beats, Elastic Agent, Kafka, syslog endpoints, and custom collectors.
• Monitor throughput, latency, and error rates; implement proactive alerting and troubleshooting.
• Create technical documentation including data flow maps and runbooks.
• Establish enterprise standards for parsing, enrichment, normalization, and ingestion patterns.
• Support audits by documenting data handling flows and pipeline logic.
• Collaborate with SIEM engineers to align pipelines with customer environments and logging needs.
• Partner with detection teams to support analytics and rule development.
• Work with infrastructure teams for deployment, scaling, and reliability engineering.

Skills

Elastic Stack

Logstash

Data ingestion

Elasticsearch

Grok patterns

ECS mapping

Kafka

Linux

Leadership

Documentation

Monitoring

Tools

Beats

Elastic Agent

Kibana

Kafka

Job description

Amentum seeks a Senior Elastic Stack Data Integration Engineer to design, build, and maintain high-fidelity data ingestion pipelines for Elastic SIEM. You will architect Logstash pipelines ingesting logs from diverse sources, implement parsing, ECS alignment, and enrichment, and ensure reliable delivery to Elasticsearch in secure environments.

This position is based at Schriever Space Force Base, CO or Redstone Arsenal, AL, with up to 10% travel.